From 57cb32b3c366585f7fafd6a741771ce826ba95f3 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Sun, 22 Mar 2020 20:26:31 +1030 Subject: [PATCH] H8300 use of uninitialised value * h8300-dis.c (bfd_h8_disassemble): Limit data[] access to that successflly read from section. --- opcodes/ChangeLog | 5 +++++ opcodes/h8300-dis.c | 34 ++++++++++++++++++++++++++++------ 2 files changed, 33 insertions(+), 6 deletions(-) diff --git a/opcodes/ChangeLog b/opcodes/ChangeLog index eb3e4c32f2..4c05e849da 100644 --- a/opcodes/ChangeLog +++ b/opcodes/ChangeLog @@ -1,3 +1,8 @@ +2020-03-22 Alan Modra + + * h8300-dis.c (bfd_h8_disassemble): Limit data[] access to that + successflly read from section. + 2020-03-22 Alan Modra * arc-dis.c (find_format): Use ISO C string concatenation rather diff --git a/opcodes/h8300-dis.c b/opcodes/h8300-dis.c index 83a82c09bd..f5e00c40c1 100644 --- a/opcodes/h8300-dis.c +++ b/opcodes/h8300-dis.c @@ -327,7 +327,7 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) const struct h8_instruction *qi; char const **pregnames = mach != 0 ? lregnames : wregnames; int status; - unsigned int l; + unsigned int maxlen; unsigned char data[MAX_CODE_NIBBLES]; void *stream = info->stream; fprintf_ftype outfn = info->fprintf_func; @@ -345,8 +345,8 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) return -1; } - for (l = 2; status == 0 && l < sizeof (data) / 2; l += 2) - status = info->read_memory_func (addr + l, data + l, 2, info); + for (maxlen = 2; status == 0 && maxlen < sizeof (data) / 2; maxlen += 2) + status = info->read_memory_func (addr + maxlen, data + maxlen, 2, info); /* Find the exact opcode/arg combo. */ for (qi = h8_instructions; qi->opcode->name; qi++) @@ -355,7 +355,7 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) const op_type *nib = q->data.nib; unsigned int len = 0; - while (1) + while (len / 2 < maxlen) { op_type looking_for = *nib; int thisnib = data[len / 2]; @@ -462,6 +462,22 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) || (looking_for & MODE) == INDEXW || (looking_for & MODE) == INDEXL) { + int extra; + switch (looking_for & SIZE) + { + case L_16: + case L_16U: + extra = 1; + break; + case L_32: + extra = 3; + break; + default: + extra = 0; + break; + } + if (len / 2 + extra >= maxlen) + break; extract_immediate (stream, looking_for, thisnib, data + len / 2, cst + opnr, cstlen + opnr, q); @@ -516,6 +532,8 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) else if ((looking_for & SIZE) == L_16 || (looking_for & SIZE) == L_16U) { + if (len / 2 + 1 >= maxlen) + break; cst[opnr] = (data[len / 2]) * 256 + data[(len + 2) / 2]; cstlen[opnr] = 16; } @@ -529,8 +547,10 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) } else if ((looking_for & SIZE) == L_32) { - int i = len / 2; + unsigned int i = len / 2; + if (i + 3 >= maxlen) + break; cst[opnr] = (((unsigned) data[i] << 24) | (data[i + 1] << 16) | (data[i + 2] << 8) @@ -540,8 +560,10 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) } else if ((looking_for & SIZE) == L_24) { - int i = len / 2; + unsigned int i = len / 2; + if (i + 2 >= maxlen) + break; cst[opnr] = (data[i] << 16) | (data[i + 1] << 8) | (data[i + 2]); cstlen[opnr] = 24; -- 2.34.1